Description

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-01T20:17:17.663Z",
  "pubdate": "2026-09-01T20:17:17.663Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists within the web-based management interface of HPE Networking Fabric Composer.\nThis vulnerability allows an unauthenticated adjacent attacker to inject and persist malicious script code into the application interface.\nWhen an authorized user accesses the compromised page, the browser executes the injected script within the security context of the HPE Networking Fabric Composer domain.\nThe primary risk involves unauthorized execution of arbitrary client-side code, which may lead to session hijacking, unauthorized administrative actions, or data theft.\nThe vulnerability requires the attacker to be in an adjacent network position relative to the target interface.\nSuccessful exploitation compromises the integrity and confidentiality of the administrative session, potentially allowing an attacker to manipulate network configurations or view sensitive management data.\nThis flaw highlights a failure in input sanitization or output encoding mechanisms within the management platform's web interface, necessitating immediate attention to secure web development practices.",
  "technicalDetails": "The vulnerability is identified as a stored XSS flaw residing in the web-based management interface of HPE Networking Fabric Composer. The root cause is the improper sanitization and validation of user-supplied data before it is persisted in the application's underlying database or persistent storage and subsequently rendered in the victim's browser.\nExploitation occurs when an attacker crafts a malicious payload containing script code and transmits it to an input field within the web interface that is vulnerable to improper handling. Because the application fails to adequately encode the input, the malicious script is stored in the system. When a different authenticated user—typically an administrator—navigates to the page where this stored data is displayed, the application renders the script without proper escaping, causing the victim's browser to parse and execute the attacker's code.\nThe execution context is the origin of the HPE Networking Fabric Composer web interface, meaning the script operates under the legitimate session of the authenticated user. This allows the script to perform any action the user is authorized to execute, such as modifying fabric configurations, creating new administrative accounts, or intercepting sensitive session tokens and cookies. The attack vector is strictly limited to an adjacent attacker, meaning the threat actor must be on the same local network segment as the target management interface.\nThe attack flow follows a three-stage progression: First, the attacker identifies a persistent input field that does not properly sanitize HTML/JavaScript characters. Second, the attacker submits a payload—such as a document.cookie exfiltration script—to this field, which is then successfully written to the system’s backend storage. Third, the victim accesses the management interface, triggering the execution of the payload within the victim’s browser. The persistence of this attack ensures that any user visiting the affected page will trigger the malicious payload, making it an effective method for long-term monitoring or administrative compromise of the networking fabric management infrastructure."
}